How to Deploy the A10 Networks Secure Service Mesh in Red Hat OpenShift

What is Red Hat OpenShift?

Red Hat OpenShift is a comprehensive enterprise-grade platform built for containers with Kubernetes. With Red Hat OpenShift, developers can easily deploy applications using a library of supported technologies, so teams can choose the languages, frameworks, and databases they use to build and deploy their services. (visit here to know more about Red Hat OpenShift)

What is A10 Networks’ Secure Service Mesh?

A10 Networks’ Secure Service Mesh solution provides an easy, automated way to integrate enterprise-grade security and load-balancing/traffic management with comprehensive application visibility and analytics with no change to applications, and across their entire lifecycle.

The unified solution offers a highly scalable, software-defined distributed architecture incorporating three key components: A10 Lightning ADC, A10 Kubernetes Connector, and A10 Harmony Controller. (For more information visit product documentation about A10 Secure Service Mesh.)

Managing Application Traffic in Red Hat OpenShift using A10 Lightning ADC

The A10 Lightning ADC daemon-set can be deployed in a Kubernetes cluster to manage containerized application traffic within the cluster. The Lightning ADC management capabilities include load balancing and application security. The Harmony Controller provides centralized management for ADCs and analytics for the applications. For more information visit the Secure Service Mesh solution brief.

Deployment Architecture

Prerequisites to deploying the A10 Networks Solution in Red Hat OpenShift

Understanding system prerequisites

• Set up master and worker nodes to deploy OpenShift on a physical or virtual system
• Install the Red Hat OpenShift
• Enable privileged containers to run in OpenShift
• Deploy A10 Harmony Controller in the data center
• Log on to Harmony Controller and create a manual Lightning ADC Cluster
• Create RBAC (Service Account) for A10 Kubernetes Connector

Deploying A10 Networks Secure Service Mesh solution in Red Hat OpenShift

Red Hat OpenShift provides configuration options using a web-based GUI and command line lnterface (CLI) to deploy the application YAML files.

Note: The deployment and configuration steps mentioned below are using the CLI. Watch this video to learn more about the deployment steps using GUI

Assuming that you have A10 Harmony Controller and Red Hat OpenShift installed and working, follow the below steps to setup the Secure Service Mesh solution.

Create a Tenant account

• Open a browser and login in to the A10 Harmony Portal using provider credentials and create a tenant account.
• Now, create a Lightning ADC manual cluster in the tenant. Once you create a Lightning ADC manual cluster, make a note of the “cluster-id” and “API server URL” information as shown in the image.

Create the A10 Lightning ADC Daemon-set

• Once you have a manual Lightning ADC cluster-id generated, you can create a Lightning ADC daemon-set by using cluster-id and API server URL parameters defined in daemon-set yaml file.
• Deploy a A10 Lightning ADC daemon-set by downloading the sample LADC_daemon_Set.yaml file to a master node.
• Edit the sample LADC_daemon_Set.yaml file and input the “ladc_cluster_id” and “API server URL” details into the file and save the changes to the file.
• Use the below command to deploy the A10 Lightning ADC daemon-set.
  # oc create -f LADC_demon_Set.yaml

Create a Secret

• Place the Harmony Controller access credentials in a Kubernetes secret using sample “secret.yaml” file.
• Edit the file and input the tenant username and password in base64 format and save the changes to the file.
• Create the tenant credential as a Kubernetes secret using the following command.
  # oc create -f secret.yaml

Create role-based Access Control

• Deploy role-based access (RBAC) by downloading the sample “RABC.yaml” file.
  # oc create -f RBAC.yaml

Create a A10 Kubernetes Connector

• Deploy A10 Kubernetes Connector by downloading the sample “deploy_A10_Kubernetes_Connector.yaml” file.
• Edit the file and input the parameters like Harmony Controller URL, tenant name, LADC cluster name, and save the changes to the file.
• Deploy the A10 Kubernetes Connector by using the following command
  # oc create -f deploy_A10_Kubernetes_Connector.yaml

Create an Ingress Resource

An ingress resource is the object that allows users to define load balancing and content switching rules.

• Create an ingress resource by downloading sample “ingress_resource.yaml” file.
• Edit the file and input the parameters like service name, hostname, back-end service name port number.
• Deploy the ingress controller resource using the below command.
  # oc create -f ingress_resource.yaml

Deploy the Kubernetes Headless Service

When a Kubernetes service is created, by default, Kube-proxy plays the role of a load balancer. When Lightning ADC is added in the path, Kube-proxy becomes redundant. Deploying the application service as a headless service eliminates Kube-proxy from the path and traffic will be routed to Lightning ADC.

• Access the application URL, i.e http://myapplication.com using a browser. The application FQDN should be configured in DNS pointing towards the Kubernetes Node(s) IP address.
• To view application traffic analytics, log-on to the A10 Harmony Controller portal GUI.

The A10 Harmony portal, “analytics dashboard” shows the real-time application user traffic stats like current traffic throughput, response time, connection details along with several metrics for different categories like client summary, ADC performance, application response time and server health, etc. The analytics metrics data helps admins to troubleshoot the application slowness or application access-related problems.

The above image shows the information summary about the client’s geo location, client requests and server response codes, number of client requests received by Lightning ADC. This helps admins to identify and control user traffic.

The above image shows the round-trip HTTP request/response time chart measured at different break-points. This helps the admin to visualize the latency at each of the break-points, providing a quick summary to quickly figure out if there are any issues that may need to be investigated.

Share this post:

Share on X (Twitter)Share on FacebookShare on LinkedInShare on Email

Categories:

Cyber Security

---

Previous Post

Top Seven DDoS Protection Challenges

Next Post

The Urgency of Network Security in the Shared LTE/5G Era

---

Arshad Khan

|

June 12, 2019